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ABSTRACT 



A system protects against loss of communication during 
network attacks. In a first implementation, a system (120) 
models the behavior of normal users in a network in 
response to an application of a first packet filtering tech* 
nique, The system (120) receives a group of packets from a 
first user subsequent to the application of (he first packet 
filtering technique and creates one or more models reflecting 
the behavior of the first user based on the received packets. 
In another implementation, a system (130) receives a stream 
of packets subsequent to a filtering technique being applied, 
partitions (he packets into groups, where each group corre- 
sponds to more than one packet, and classifies each group of 
packets as a normal group or an attack group using one or 
mom models. Each model reflects a normal response to an 
application of the filtering technique. The system (130) 
forwards groups classified as normal groups, thus preventing 
network attacks from choking off all communication in the 
network. 
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